LockBit 5.0 made its debut in late September 2025, marking a significant upgrade for one of the most notorious ransomware-as-a-service (RaaS) groups.

With roots tracing back to the ABCD ransomware in 2019, LockBit rapidly grew in sophistication, consistently updating its tactics despite facing aggressive law enforcement efforts and affiliate panel leaks.

The latest version is built on the existing v4.0 codebase, yet it introduces new methods designed to maximize evasion and destructive impact across diverse organizational networks.

FlashPoint security analysts identified LockBit 5.0’s uniquely modular architecture as a notable innovation in the ransomware’s ongoing evolution.

Their detailed technical analysis highlights how this malware continues to threaten critical infrastructure by leveraging advanced execution and obfuscation strategies.

Large-scale attacks have been observed targeting industries irrespective of their geographic and operational boundaries, ensuring LockBit’s continued reputation for stealth and resilience.

One standout advancement in LockBit 5.0 is its two-stage execution model, which expertly divides the infection process into loader and payload phases.

The initial stage involves a stealthy loader built for persistence and anti-analysis, employing control flow obfuscation to dynamically calculate execution paths and complicate reverse engineering.

The loader dynamically resolves API calls using a hashing algorithm, then reloads fresh copies of core libraries—such as NTDLL and Kernel32—effectively bypassing hooks placed by security tools.

After creating a suspended instance of defrag.exe, it injects the decrypted payload through process hollowing, updating the instruction pointer with ZwWriteProcessMemory and resuming execution in memory, all while evading standard detection mechanisms.

// Process hollowing code snippet excerpt
HANDLE hProcess = CreateProcess("defrag.exe", ...);
ZwWriteProcessMemory(hProcess, ...); // Inject LockBit payload
ResumeThread(hProcess);

This technical breakdown demonstrates LockBit’s commitment to maximizing operational stealth and survivability.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Analysis Uncovers LockBit 5.0 Key Capabilities and Two-Stage Execution Model appeared first on Cyber Security News.

Russian-based threat actors are distributing a sophisticated Android Remote Access Trojan through underground channels, offering it as a subscription service to other criminals.

The malware, identified as Fantasy Hub, enables attackers to conduct widespread surveillance operations on compromised mobile devices, stealing sensitive communications and personal information from unsuspecting users.

The spyware’s capabilities extend far beyond basic data theft, providing attackers with tools to intercept two-factor authentication messages, access banking credentials, and perform real-time device monitoring.

Fantasy Hub operates under a Malware-as-a-Service model, significantly lowering the technical barriers for attackers with minimal expertise.

Threat actors advertise the malware on Russian-language channels and include links to a Telegram bot that manages subscriptions and provides access to the malware builder.

The attackers refer to compromised devices and their owners as “mammoths,” drawing users into a sophisticated social engineering ecosystem that combines phishing techniques with technical sophistication.

Attackers receive complete documentation, including video tutorials, on deploying the malware and bypassing security restrictions.

Zimperium security researchers identified Fantasy Hub’s sophisticated infrastructure, which includes a Russian-language command and control panel and comprehensive operational guides for attackers.

The malware’s targeting strategy specifically focuses on financial institutions such as Alfa, PSB, Tbank, and Sber, where operators deploy fake login windows to capture banking credentials.

This financial focus underscores the serious threat posed to enterprise environments where employees use mobile banking or sensitive applications on personal devices.

Technical Evasion Mechanisms

Fantasy Hub employs advanced detection evasion tactics to remain hidden from security analysis.

The malware utilizes a native dropper embedded within a metamask_loader library that decrypts an encrypted asset called metadata.dat during runtime.

The decryption process relies on a custom XOR encryption routine using a fixed 36-byte key pattern, followed by gzip decompression through zlib.

This two-stage encryption approach significantly reduces static indicators that traditional antivirus solutions might detect.

The malware further leverages the SMS handler role abuse technique, similar to ClayRat spyware, consolidating multiple powerful permissions including contacts, camera, and file access into a single authorization step.

The dropper masquerades as a Google Play Update to lower user suspicion, while recent samples demonstrate root detection capabilities to evade dynamic analysis environments.

Additionally, Fantasy Hub integrates WebRTC for establishing live audio and video streaming channels, enabling real-time surveillance capabilities that significantly expand the attacker’s reconnaissance potential beyond traditional data exfiltration methods.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Android Malware ‘Fantasy Hub’ Intercepts SMS Messages, Contacts and Call Logs appeared first on Cyber Security News.

A sophisticated supply-chain attack has emerged targeting Windows systems through compromised npm packages, marking a critical vulnerability in open-source software distribution.

Between October 21 and 26, 2025, threat actors published 17 malicious npm packages containing 23 releases designed to deliver Vidar infostealer malware.

The campaign exploited the trust developers place in package registries, leveraging legitimate-appearing packages that masqueraded as Telegram bot helpers, icon libraries, and forks of popular projects including Cursor and React.

The attack leveraged two recently created npm accounts, aartje and saliii229911, which published packages downloaded over 2,240 times before removal from the registry.

This distribution method represents a paradigm shift for Vidar, historically spread through phishing emails with malicious Office documents.

The deceptive packaging and seemingly legitimate functionality allowed the malicious code to propagate widely before detection.

Datadog Security Labs security researchers identified the campaign through their GuardDog static analyzer, which flagged suspicious indicators including postinstall script execution and process spawning operations.

The discovery revealed that all packages executed identical attack chains through postinstall scripts, with some variants using PowerShell commands embedded directly in package.json files.

Infection Mechanism and Technical Breakdown

The attack demonstrates remarkable simplicity in execution. When developers installed compromised packages, postinstall scripts automatically triggered, downloading an encrypted ZIP archive from bullethost.cloud infrastructure.

The downloader scripts used hardcoded credentials to extract the archive, retrieving bridle.exe, a Go-compiled Vidar variant previously unseen in npm distributions.

The malware then executed with system privileges, initiating the information theft process.

This Vidar variant collects sensitive data including browser credentials, cookies, cryptocurrency wallets, and system files before exfiltrating stolen information through command-and-control infrastructure.

The malware discovers active C2 servers by querying hardcoded Telegram and Steam throwaway accounts containing regularly updated C2 domains.

After successful data exfiltration, the malware deletes traces of itself, complicating post-compromise detection.

The campaign represents a sophisticated understanding of npm ecosystem vulnerabilities.

Threat actors rotated between multiple C2 domains and implemented variations in postinstall script implementations, likely to evade pattern-based detection systems.

All affected packages remained live on npm for approximately two weeks, establishing this as one of the most consequential npm-based malware campaigns targeting enterprise development environments and individual developers worldwide.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post 15+ Weaponized npm Packages Attacking Windows Systems to Deliver Vidar Malware appeared first on Cyber Security News.

A sophisticated phishing campaign is actively targeting hotel establishments and their guests through compromised Booking.com accounts, according to research uncovered by security experts.

The campaign, dubbed “I Paid Twice” due to evidence of victims paying twice for their reservations, has been operating since at least April 2025 and remains active as of October 2025.

The attack scheme combines credential theft with multi-stage malware deployment, creating a complex threat targeting the global hospitality sector.

The operation begins when threat actors compromise hotel administrator systems through spearphishing emails that impersonate legitimate Booking.com communications.

These emails contain carefully crafted messages referencing guest reservations and booking platform activities, lending them credibility to unsuspecting recipients.

The emails include malicious URLs that redirect victims through a sophisticated redirection infrastructure before deploying the ClickFix social engineering tactic.

Once victims execute the downloaded commands, malware infects their systems, granting attackers access to professional credentials for booking platforms like Booking.com and Expedia.

The broader criminal ecosystem supporting this operation reveals an alarming level of professionalization within cybercrime communities.

Threat actors harvest hotel administrator credentials and sell them through Russian-speaking cybercrime forums and marketplaces.

High-value compromised Booking.com accounts managing multiple properties in developed nations command prices between $5 and $5,000 depending on activity levels and reservation volumes.

This commodification of stolen credentials has created a self-sustaining fraud pipeline where specialized services handle each phase of the attack chain.

Sekoia security researchers identified the malware family PureRAT at the core of this infection chain.

Once deployed through the ClickFix redirection mechanism, PureRAT executes PowerShell commands that gather system information and download additional payload files.

The malware establishes persistence through Windows registry modifications and implements a sophisticated loader mechanism using DLL side-loading techniques.

Technical Breakdown of the Infection Mechanism

The attack initiates when victims receive phishing emails from compromised hotel accounts. Malicious URLs redirect through randomized domains following the pattern hxxps://{randomname}[.]com/[a-z0-9]{4}.

These domains employ sophisticated JavaScript that checks iframe contexts before redirecting users to ClickFix pages.

The redirection infrastructure serves as a commercialized Traffic Distribution System (TDS), concealing the attacker’s primary infrastructure from detection and takedown efforts.

Each redirection step carefully preserves URL patterns containing keywords like “admin” and “extranet” to maintain perceived legitimacy during the social engineering phase.

When users land on ClickFix pages, they encounter Booking.com brand elements alongside a reCAPTCHA interface prompting them to copy commands.

The copied command contains Base64-encoded PowerShell instructions that execute without user awareness.

This initial PowerShell command downloads secondary scripts from staging URLs ending in /bomla, which orchestrates the infection progression.

The loader gathers comprehensive system information including machine name, current user, Windows version, and installed antivirus products before downloading a ZIP archive containing executable and dynamic link library files.

Persistence mechanisms employ multiple techniques to ensure malware survives system restarts. The installation process creates Run registry keys under CurrentVersion\Run that execute PowerShell commands loading the extracted binary.

Additionally, shortcut files (.lnk) are placed in the Windows Startup directory to trigger execution during boot sequences.

The malware reports status updates at each infection stage through Command and Control servers, confirming successful progression.

The .exe binary triggers DLL side-loading using AddInProcess32.exe, a legitimate Windows component designed to host COM add-ins.

This technique allows PureRAT to execute entirely in memory without writing files to disk, significantly complicating detection efforts and enabling fileless malware execution that bypasses traditional signature-based security tools.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Phising Attack Targeting Travellers from Hotel’s Compromised Booking.com Account appeared first on Cyber Security News.